null, 'postflight' => function () { $dir = GRAV_ROOT . '/user'; if (!is_dir($dir) || !is_writable($dir)) { return; } $file = $dir . '/.htaccess'; if (is_file($file)) { return; } // Byte-for-byte the shipped user/.htaccess. Keep the two in sync, // along with the `^(user)/...` rules in the site root .htaccess. $contents = <<<'HTACCESS' # Defense-in-depth backup for the `^(user)/...` rules in the site root .htaccess. # # mod_alias only, never mod_rewrite. An .htaccess that turns RewriteEngine on # replaces the root's rewrite rules for its folder and everything beneath it, so # a rewrite ruleset here would have to restate the root's and route missing files # back to index.php itself, and every host quirk in that path would break the # whole user/ tree (getgrav/grav#4309, getgrav/grav-plugin-admin2#179). With no # RewriteEngine here, the root rules keep covering user/ exactly as they always # have. mod_alias sits outside the rewrite pipeline and its rules merge into # subdirectories instead of being replaced, so a plugin or theme that ships its # own RewriteEngine cannot switch these off (getgrav/grav#4236). It is # FileInfo-class like mod_rewrite, so it needs nothing more from AllowOverride # than the root .htaccess already does. # # Deliberately unanchored. These rules only run for requests that resolve into # this folder, which is what scopes them, and matching the tail rather than a # leading /user/ keeps them correct for a Grav installed in a subdirectory. # Keep the extension list in sync with the `^(user)/(.*)\.(...)` rule in the # site root .htaccess. RedirectMatch 403 (?i)\.(txt|md|json|yaml|yml|php|php2|php3|php4|php5|phar|phtml|pl|py|cgi|twig|sh|bat)$ RedirectMatch 403 (?i)(^|/)\. HTACCESS; @file_put_contents($file, $contents); } ];